{"metadata": {"vulnerability": "CVE-2026-48356", "count": 68, "kinds": {"milestone": 5, "sighting": 38, "kev": 11, "other": 14}}, "data": [{"timestamp": "2026-05-21T15:28:38.140Z", "date_only": false, "value": "2026-05-21T15:28:38.140Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-48356", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-07-14T00:00:00Z", "date_only": false, "value": "2026-07-14T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-48356", "field": "containers.adp.0.metrics.0.other.content.timestamp"}, {"timestamp": "2026-07-14T00:00:00Z", "date_only": false, "value": "2026-07-14T00:00:00+00:00", "kind": "other", "label": "Recorded", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48356", "record": "FKIE_CVE-2026-48356", "field": "metrics.ssvcV203.0.ssvcData.timestamp"}, {"timestamp": "2026-07-14T17:00:00Z", "date_only": false, "value": "2026-07-14T17:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / adobe", "record": "CVE-2026-48356", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-14T19:44:17.036Z", "date_only": false, "value": "2026-07-14T19:44:17.036Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-48356", "field": "cveMetadata.datePublished", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-14T20:17:08Z", "date_only": false, "value": "2026-07-14T20:17:08Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-P3CH-8535-FP8J", "record": "GHSA-P3CH-8535-FP8J", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-07-14T20:17:08.437Z", "date_only": false, "value": "2026-07-14T20:17:08.437", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48356", "record": "FKIE_CVE-2026-48356", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-14T21:32:19Z", "date_only": false, "value": "2026-07-14T21:32:19Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-P3CH-8535-FP8J", "record": "GHSA-P3CH-8535-FP8J", "field": "published", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-14T22:00:00Z", "date_only": false, "value": "2026-07-14T22:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2367", "record": "WID-SEC-W-2026-2367", "field": "document.tracking.revision_history.0.date"}, {"timestamp": "2026-07-14T22:00:00Z", "date_only": false, "value": "2026-07-14T22:00:00.000+00:00", "kind": "milestone", "label": "Published", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2367", "record": "WID-SEC-W-2026-2367", "field": "document.tracking.initial_release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-14T22:00:00Z", "date_only": false, "value": "2026-07-14T22:00:00.000+00:00", "kind": "other", "label": "Release date", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2367", "record": "WID-SEC-W-2026-2367", "field": "vulnerabilities.11.release_date", "metric_role": "disclosure", "metric_basis": "recorded_event"}, {"timestamp": "2026-07-14T22:12:04.236Z", "date_only": false, "value": "2026-07-14T22:12:04.236315Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mqn7zmfnfg2f", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "d490cede-c921-4bca-bb3a-71bb608f569f", "content": "CVE-2026-48356 - adobe commerce\nAdobe Commerce has a security issue where malicious files can be uploaded and potentially executed by a user. This could allow an attacker to gain control over a user's\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#adobecommerce #adobe #CVE #infosec", "url": "https://bsky.app/profile/stackflag.bsky.social/post/3mqn7zmfnfg2f"}, {"timestamp": "2026-07-15T10:18:08.807Z", "date_only": false, "value": "2026-07-15T10:18:08.807680Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/experiencedigest.bsky.social/post/3mqoilwqix325", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "b141ce4c-c188-4076-8b66-5fc255ef7c5b", "content": "CVE-2026-48356 (CRITICAL) CVSS 9.6: https://experiencedigest.org/2026/07/15/cve-critical-cvss.html", "url": "https://bsky.app/profile/experiencedigest.bsky.social/post/3mqoilwqix325"}, {"timestamp": "2026-07-15T14:38:21.577Z", "date_only": false, "value": "2026-07-15T14:38:21.577295Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3mqox5abuoz2l", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "372ce924-0ef7-47a7-bbe3-811d4f5c3bf7", "content": "Adobe Commerce is affected by critical vulnerability CVE-2026-48356, CVSS 9.6, that allows arbitrary code execution via unrestricted file uploads requiring user interaction.", "url": "https://bsky.app/profile/thecircuitry.to/post/3mqox5abuoz2l"}, {"timestamp": "2026-07-16T05:37:06.261Z", "date_only": false, "value": "2026-07-16T05:37:06.261440Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyberhub.blog/post/3mqqjecu6yp26", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "4bc8661f-9bec-4f82-a4c7-696d26d07d79", "content": "\ud83d\udccc CVE-2026-48356 - Adobe Commerce is affected by an Unrestricted Upload of File with Dangerous Type vulnerability that could result in arbitrary code execution in the co... https://www.cyberhub.blog/cves/CVE-2026-48356", "url": "https://bsky.app/profile/cyberhub.blog/post/3mqqjecu6yp26"}, {"timestamp": "2026-08-27T22:39:18.114Z", "date_only": false, "value": "2026-08-27T22:39:18.114Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / adobe", "record": "CVE-2026-48356", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-09-26T15:00:07Z", "date_only": false, "value": "2026-09-26T15:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/ZwzTOKK99bJ7BFqHmsNQhcBtNpWeVQ50id2s1j08rwHDfjQ", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "0a4e2c62-7bb7-42e6-aa5c-6e443796f946", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-09-26T15:00:07Z", "date_only": false, "value": "2026-09-26T15:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/ZwzTOKK99bJ7BFqHmsNQhcBtNpWeVQ50id2s1j08rwHDfjQ", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "ab4364dd-e3ac-483e-84d8-700cfd41495a"}, {"timestamp": "2026-10-26T13:30:25.808Z", "date_only": false, "value": "2026-10-26T13:30:25.808100Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/offseq/statuses/117507452118474111", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "8bc5d0a4-af17-47cc-9fcb-a2269bb84954", "content": "HIGH severity: 953 Magento stores infected by loader malware since July 2025 \ud83d\uded2 Loader uses visitor fingerprinting and exploits CVE-2026-48356 & CVE-2025-54236. Inspect for rogue admin accounts, backdoors, and patch now. https://radar.offseq.com/threat/953-online-stores-infected-in-long-lasting-malware-campaign-884b9644d42ac663 #OffSeq #Magento #Malware", "url": "https://infosec.exchange/users/offseq/statuses/117507452118474111"}, {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-48356", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "2ddf3cd3-17ec-4eed-8360-1b806ca6c707", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-27T00:00:00Z", "date_only": true, "value": "2026-10-27", "kind": "kev", "label": "Date added", "source": "cisa-kev", "record": "CVE-2026-48356", "field": "evidence.0.details.date_added", "uuid": "2ddf3cd3-17ec-4eed-8360-1b806ca6c707", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00+00:00", "kind": "kev", "label": "First seen", "source": "cisa-kev", "record": "CVE-2026-48356", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "2ddf3cd3-17ec-4eed-8360-1b806ca6c707", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00+00:00", "kind": "kev", "label": "Status updated", "source": "cisa-kev", "record": "CVE-2026-48356", "field": "status.status_updated_at", "uuid": "2ddf3cd3-17ec-4eed-8360-1b806ca6c707", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-27T05:31:35.959Z", "date_only": false, "value": "2026-10-27T05:31:35.959696Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thebadgamer.bsky.social/post/3mytj3bskxj2i", "record": "cve-2026-48356", "field": "creation_timestamp", "uuid": "49de03a4-cddf-4e7e-9c48-2e669b69b3fc", "content": "Magento\u2019s 953-store loader campaign calls for a CMS database check, backdoor removal and credential rotation, even on stores with current core patches.\u2026\nhttps://www.trickyworld.in/computer-tricks/cyber-security/cve-2026-48356-cleanup-beyond-magento-patches/?utm_medium=social", "url": "https://bsky.app/profile/thebadgamer.bsky.social/post/3mytj3bskxj2i"}, {"timestamp": "2026-10-27T13:04:38Z", "date_only": false, "value": "2026-10-27T13:04:38.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/true_secator/8755", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "113ed750-3f8a-4690-be4c-dc4a0f8aee7d", "content": "\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 Sansec \u0440\u0430\u0441\u043a\u0440\u044b\u043b\u0438 \u043c\u0430\u0441\u0448\u0442\u0430\u0431\u043d\u0443\u044e \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u043a\u0430\u043c\u043f\u0430\u043d\u0438\u044e, \u0432 \u0440\u0430\u043c\u043a\u0430\u0445 \u043a\u043e\u0442\u043e\u0440\u043e\u0439 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u0437\u0430\u0440\u0430\u0437\u0438\u043b 953 \u0418\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430, \u0431\u043e\u043b\u044c\u0448\u0438\u043d\u0441\u0442\u0432\u043e \u0438\u0437 \u043d\u0438\u0445 \u0440\u0430\u0431\u043e\u0442\u0430\u044e\u0442 \u043d\u0430 \u043f\u043b\u0430\u0442\u0444\u043e\u0440\u043c\u0435 Magento.\n\n\u0410\u0442\u0430\u043a\u0438 \u043f\u0440\u043e\u0434\u043e\u043b\u0436\u0430\u044e\u0442\u0441\u044f \u0441 \u0438\u044e\u043b\u044f 2025 \u0433\u043e\u0434\u0430 \u0441 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u0435\u043c \u043f\u044f\u0442\u0438 \u0440\u0430\u0437\u043d\u044b\u0445 \u0434\u043e\u043c\u0435\u043d\u043e\u0432 \u0434\u043b\u044f \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 JavaScript. \u041f\u0435\u0440\u0432\u044b\u0435 \u0447\u0435\u0442\u044b\u0440\u0435 - manulfie.click, neswnsssn.click, lanhd6549tdhse.top \u0438 additionalver.com - \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u0441\u0440\u0430\u0437\u0443 \u0434\u043b\u044f \u043d\u0435\u0441\u043a\u043e\u043b\u044c\u043a\u0438\u0445 \u0441\u043e\u0442\u0435\u043d \u043c\u0430\u0433\u0430\u0437\u0438\u043d\u043e\u0432.\n\n\u0414\u043e\u043c\u0435\u043d\u044b neswnsssn.click \u0438 manulfie.click \u0443\u0442\u0440\u0430\u0442\u0438\u043b\u0438 \u0441\u0432\u043e\u044e \u0430\u043a\u0442\u0443\u0430\u043b\u044c\u043d\u043e\u0441\u0442\u044c \u0438 \u0431\u044b\u043b\u0438 \u043f\u0435\u0440\u0435\u0440\u0435\u0433\u0438\u0441\u0442\u0440\u0438\u0440\u043e\u0432\u0430\u043d\u044b \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e \u0432 \u043c\u0430\u0435 2026 \u0433\u043e\u0434\u0430. \u0422\u0435\u043f\u0435\u0440\u044c \u043e\u0431\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u0443\u044e\u0442 \u0441\u0435\u0440\u0432\u0435\u0440\u044b abovedomains.com. \u0412 \u043f\u0435\u0440\u0438\u043e\u0434 \u0441 \u0430\u0432\u0433\u0443\u0441\u0442\u0430 \u043f\u043e \u043e\u043a\u0442\u044f\u0431\u0440\u044c 2026 Sansec \u0432\u044b\u044f\u0432\u0438\u043b\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a manulfie.click \u0432 9 \u0445\u0440\u0430\u043d\u0438\u043b\u0438\u0449\u0430\u0445, \u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a neswnsssn.click - \u0432 6.\n\n\u041f\u043e\u0437\u0436\u0435 \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a \u043f\u0435\u0440\u0435\u043a\u043b\u044e\u0447\u0438\u043b\u0441\u044f \u043d\u0430 \u0434\u043e\u043c\u0435\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 deepveindrilling.com, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043d\u0430\u0445\u043e\u0434\u0438\u0442\u0441\u044f \u0437\u0430 Cloudflare \u0438 \u043e\u0442\u0432\u0435\u0447\u0430\u0435\u0442 \u0442\u043e\u043b\u044c\u043a\u043e \u043d\u0430 \u0437\u0430\u043f\u0440\u043e\u0441\u044b \u043e\u0442 \u0441\u043a\u0440\u0438\u043f\u0442\u043e\u0432, \u0437\u0430\u0433\u0440\u0443\u0436\u0435\u043d\u043d\u044b\u0445 \u0432 \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u044b \u043f\u043e\u0441\u0435\u0442\u0438\u0442\u0435\u043b\u0435\u0439 \u0437\u0430\u0440\u0430\u0436\u0435\u043d\u043d\u044b\u0445 \u043c\u0430\u0433\u0430\u0437\u0438\u043d\u043e\u0432.\n\n\u041f\u043e \u0434\u0430\u043d\u043d\u044b\u043c Sansec, \u043f\u043e\u0433\u0440\u0443\u0437\u0447\u0438\u043a deepveindrilling.com \u0431\u044b\u043b \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0435\u043d \u0432 83 \u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430\u0445, \u0432 \u0442\u043e\u043c \u0447\u0438\u0441\u043b\u0435 \u0432 60, \u0433\u0434\u0435 \u0440\u0430\u043d\u0435\u0435 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043b\u0438\u0441\u044c \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u043f\u043e\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430.\n\n\u041f\u0440\u0438\u0447\u0435\u043c Sansec Watch, \u0441\u043b\u0443\u0436\u0431\u0430 \u043c\u043e\u043d\u0438\u0442\u043e\u0440\u0438\u043d\u0433\u0430 \u043f\u043e\u0441\u0442\u0430\u0432\u0449\u0438\u043a\u043e\u0432 \u043e\u0431\u043b\u0430\u0447\u043d\u044b\u0445 \u0443\u0441\u043b\u0443\u0433, \u043e\u0442\u0441\u043b\u0435\u0434\u0438\u043b\u0430, \u0447\u0442\u043e \u0431\u0440\u0430\u0443\u0437\u0435\u0440\u044b \u043f\u043e\u0441\u0435\u0442\u0438\u0442\u0435\u043b\u0435\u0439 \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b\u0438 \u0432\u0441\u0435 \u0447\u0435\u0442\u044b\u0440\u0435 \u0440\u0430\u043d\u0435\u0435 \u0443\u043f\u043e\u043c\u044f\u043d\u0443\u0442\u044b\u0445 \u0434\u043e\u043c\u0435\u043d\u0430, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043e\u043a\u043e\u043b\u043e 52 000 \u0434\u043b\u044f additionalver.com.\n\n\u0412 \u043c\u0430\u0440\u0442\u0435 \u0432 471 \u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0435 Magento \u0431\u044b\u043b \u0432\u043d\u0435\u0434\u0440\u0435\u043d \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u0447\u0435\u0440\u0435\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c PolyShell (CVE-2026-48356). Sansec \u0442\u0430\u043a\u0436\u0435 \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b\u0430 \u0431\u043e\u043b\u0435\u0435 100 \u043c\u0430\u0433\u0430\u0437\u0438\u043d\u043e\u0432, \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u0444\u0430\u0439\u043b\u044b \u0437\u0430\u0433\u0440\u0443\u0436\u0430\u043b\u0438\u0441\u044c \u0447\u0435\u0440\u0435\u0437 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 PolyShell \u0438\u043b\u0438 SessionReaper (CVE-2025-54236).\n\n\u0412 \u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0430\u0445 \u0441 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u043d\u044b\u043c\u0438 \u043f\u0430\u0442\u0447\u0430\u043c\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a \u0442\u043e\u0436\u0435 \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f: \u0432 \u043e\u0434\u043d\u043e\u043c \u043c\u0430\u0433\u0430\u0437\u0438\u043d\u0435 \u043d\u0430 Magento 2.4.7-p10 deepveindrilling.com \u043f\u043e\u044f\u0432\u0438\u043b\u0441\u044f \u0432 16:46 UTC 23 \u043e\u043a\u0442\u044f\u0431\u0440\u044f, \u0447\u0435\u0440\u0435\u0437 \u0447\u0430\u0441 \u043f\u043e\u0441\u043b\u0435 \u0447\u0438\u0441\u0442\u043e\u0433\u043e \u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f. eComscan \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u043d\u0430 \u043d\u0435\u043c \u0432\u0440\u0435\u0434\u043e\u043d\u043e\u0441\u043d\u0443\u044e \u0443\u0447\u0435\u0442\u043d\u0443\u044e \u0437\u0430\u043f\u0438\u0441\u044c \u0430\u0434\u043c\u0438\u043d\u0430 16 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f \u0438 \u0431\u044d\u043a\u0434\u043e\u0440 GSocket 24 \u0441\u0435\u043d\u0442\u044f\u0431\u0440\u044f.\n\n\u041a\u043e\u0434 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u0431\u044b\u043b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043d \u0434\u043b\u044f \u0432\u044b\u043f\u043e\u043b\u043d\u0435\u043d\u0438\u044f \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0446\u0438\u0438 \u043f\u043e\u0441\u0435\u0442\u0438\u0442\u0435\u043b\u0435\u0439 \u043f\u043e \u0444\u0438\u043d\u0433\u0435\u0440\u043f\u0440\u0438\u043d\u0442\u0430\u043c, \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u044f \u043f\u043e\u043b\u0435\u0437\u043d\u0443\u044e \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0443 \u0442\u043e\u043b\u044c\u043a\u043e \u0440\u0435\u0430\u043b\u044c\u043d\u044b\u043c \u043f\u043e\u0441\u0435\u0442\u0438\u0442\u0435\u043b\u044f\u043c, \u0432\u043e \u0438\u0437\u0431\u0435\u0436\u0430\u043d\u0438\u0435 \u043f\u0440\u043e\u0432\u0435\u0440\u043e\u043a \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u0438.\n\nSansec \u043f\u043e\u043a\u0430 \u043d\u0435 \u0443\u0434\u0430\u043b\u043e\u0441\u044c \u0438\u0437\u0443\u0447\u0438\u0442\u044c \u043e\u043a\u043e\u043d\u0447\u0430\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0432\u0430\u0440\u0438\u0430\u043d\u0442 \u043f\u043e\u043b\u0435\u0437\u043d\u043e\u0439 \u043d\u0430\u0433\u0440\u0443\u0437\u043a\u0438, \u043d\u043e \u043f\u0440\u0435\u0434\u044b\u0434\u0443\u0449\u0438\u0435 \u0432\u0435\u0440\u0441\u0438\u0438 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430 \u0434\u043e\u0441\u0442\u0430\u0432\u043b\u044f\u043b\u0438 \u043f\u043e\u0441\u0435\u0442\u0438\u0442\u0435\u043b\u044f\u043c \u0441\u043a\u0440\u0438\u043f\u0442\u044b \u0441 \u0434\u043e\u043c\u0435\u043d\u043e\u0432, \u0441\u0432\u044f\u0437\u0430\u043d\u043d\u044b\u0445 \u0441 \u043a\u0440\u0438\u043f\u0442\u043e\u0432\u0430\u043b\u044e\u0442\u0430\u043c\u0438, \u0432\u043a\u043b\u044e\u0447\u0430\u044f \u043e\u0434\u0438\u043d, \u0438\u043c\u0438\u0442\u0438\u0440\u0443\u044e\u0449\u0438\u0439 \u0431\u0440\u0435\u043d\u0434 \u043a\u043e\u0448\u0435\u043b\u044c\u043a\u0430 Ledger.\n\n\u0412\u043b\u0430\u0434\u0435\u043b\u044c\u0446\u0430\u043c \u0438\u043d\u0442\u0435\u0440\u043d\u0435\u0442-\u043c\u0430\u0433\u0430\u0437\u0438\u043d\u043e\u0432 \u0440\u0435\u043a\u043e\u043c\u0435\u043d\u0434\u0443\u0435\u0442\u0441\u044f \u043f\u0435\u0440\u0435\u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c CMS \u0441\u0432\u043e\u0438\u0445 \u0441\u0430\u0439\u0442\u043e\u0432 \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u043a\u043e\u0434\u0430 \u0437\u0430\u0433\u0440\u0443\u0437\u0447\u0438\u043a\u0430, \u0430 \u0442\u0430\u043a\u0436\u0435 \u043f\u0440\u043e\u0441\u043a\u0430\u043d\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043a\u0443 \u043d\u0430 \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0438 \u0431\u044d\u043a\u0434\u043e\u0440\u043e\u0432, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043c\u043e\u0433\u0443\u0442 \u0431\u044b\u0442\u044c \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u044b \u0437\u043b\u043e\u0443\u043c\u044b\u0448\u043b\u0435\u043d\u043d\u0438\u043a\u0430\u043c\u0438.\n\n\u041a\u0440\u043e\u043c\u0435 \u0442\u043e\u0433\u043e, \u0441\u043b\u0435\u0434\u0443\u0435\u0442 \u043f\u0440\u043e\u0432\u0435\u0440\u0438\u0442\u044c \u043d\u0430\u043b\u0438\u0447\u0438\u0435 \u0444\u0435\u0439\u043a\u043e\u0432\u044b\u0445 \u0430\u0434\u043c\u0438\u043d\u0441\u043a\u0438\u0445 \u0443\u0447\u0435\u0442\u043d\u044b\u0445 \u0437\u0430\u043f\u0438\u0441\u0435\u0439, \u0432\u044b\u043f\u043e\u043b\u043d\u0438\u0442\u044c \u043e\u0447\u0438\u0441\u0442\u043a\u0443 \u0438 \u0441\u043c\u0435\u043d\u0438\u0442\u044c \u0432\u0441\u0435 \u043f\u0430\u0440\u043e\u043b\u0438, \u0443\u0431\u0435\u0434\u0438\u0432\u0448\u0438\u0441\u044c, \u0447\u0442\u043e \u043d\u0430 \u0441\u0435\u0440\u0432\u0435\u0440\u0430\u0445 \u0443\u0441\u0442\u0430\u043d\u043e\u0432\u043b\u0435\u043d\u044b \u043f\u043e\u0441\u043b\u0435\u0434\u043d\u0438\u0435 \u0434\u043e\u0441\u0442\u0443\u043f\u043d\u044b\u0435 \u043e\u0431\u043d\u043e\u0432\u043b\u0435\u043d\u0438\u044f.", "url": "https://t.me/true_secator/8755"}, {"timestamp": "2026-10-27T13:41:21Z", "date_only": false, "value": "2026-10-27T13:41:21.000000Z", "kind": "sighting", "label": "Seen", "source": "https://cyber.gc.ca/en/alerts-advisories/adobe-security-advisory-av26-697", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "a3fbafed-dadf-43be-851d-06b58bbb88d2", "url": "https://cyber.gc.ca/en/alerts-advisories/adobe-security-advisory-av26-697"}, {"timestamp": "2026-10-27T15:30:08.422Z", "date_only": false, "value": "2026-10-27T15:30:08.422772Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/fc-vulns.bsky.social/post/3myukjl7tt622", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "d3242100-9151-4100-b146-b7516026604c", "content": "CVE-2026-48356: EPSS +29.6 points (1.0 \u2192 30.6, 0\u2013100 scale).\n\nDon\u2019t miss this EPSS jump.\n\nhttps://www.fc-vulns.com/cve/CVE-2026-48356/\n\n#fcvulns #EPSS", "url": "https://bsky.app/profile/fc-vulns.bsky.social/post/3myukjl7tt622"}, {"timestamp": "2026-10-27T20:00:01Z", "date_only": false, "value": "2026-10-27T20:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "cisa-kev", "record": "CVE-2026-48356", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "2ddf3cd3-17ec-4eed-8360-1b806ca6c707", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-27T20:00:02.647Z", "date_only": false, "value": "2026-10-27T20:00:02.647213Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/2ddf3cd3-17ec-4eed-8360-1b806ca6c707", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "eff0ffba-2556-404a-b88f-7ad588111553", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/2ddf3cd3-17ec-4eed-8360-1b806ca6c707", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-27T20:00:08Z", "date_only": false, "value": "2026-10-27T20:00:08.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "https://t.me/GithubRedTeam/107634", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "eda851d3-1566-4a3b-ae82-d3c3af8bbeb2", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48356\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a piecar21\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-27 19:52:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC / exploit archive for CVE-2026-48356\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/107634", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-27T20:00:08Z", "date_only": false, "value": "2026-10-27T20:00:08.000000Z", "kind": "sighting", "label": "Seen", "source": "https://t.me/GithubRedTeam/107634", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "8824ae72-13a6-44a6-bd19-467d2ce20986", "content": "\ud83d\udea8 GitHub \u76d1\u63a7\u6d88\u606f\u63d0\u9192\n\n\ud83d\udea8 \u53d1\u73b0\u5173\u952e\u8bcd\uff1a #CVE-2026 #POC #Exploit\n\n\ud83d\udce6 \u9879\u76ee\u540d\u79f0\uff1a CVE-2026-48356\n\ud83d\udc64 \u9879\u76ee\u4f5c\u8005\uff1a piecar21\n\ud83d\udee0 \u5f00\u53d1\u8bed\u8a00\uff1a Unknown\n\u2b50 Star\u6570\u91cf\uff1a 0  |  \ud83c\udf74 Fork\u6570\u91cf\uff1a 0\n\ud83d\udcc5 \u66f4\u65b0\u65f6\u95f4\uff1a 2026-10-27 19:52:46\n\n\ud83d\udcdd \u9879\u76ee\u63cf\u8ff0\uff1a\nPoC / exploit archive for CVE-2026-48356\n\n\ud83d\udd17 \u70b9\u51fb\u8bbf\u95ee\u9879\u76ee\u5730\u5740", "url": "https://t.me/GithubRedTeam/107634"}, {"timestamp": "2026-10-27T20:01:36Z", "date_only": false, "value": "2026-10-27T20:01:36+00:00", "kind": "kev", "label": "Asserted", "source": "previdian", "record": "CVE-2026-48356", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "beba3015-09e3-4e53-8171-0094c4b96c71", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-27T20:01:36Z", "date_only": false, "value": "2026-10-27T20:01:36+00:00", "kind": "kev", "label": "First seen", "source": "previdian", "record": "CVE-2026-48356", "field": "timestamps.first_seen_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "beba3015-09e3-4e53-8171-0094c4b96c71", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-27T20:01:36Z", "date_only": false, "value": "2026-10-27T20:01:36+00:00", "kind": "kev", "label": "Status updated", "source": "previdian", "record": "CVE-2026-48356", "field": "status.status_updated_at", "uuid": "beba3015-09e3-4e53-8171-0094c4b96c71", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-27T20:01:36.935Z", "date_only": false, "value": "2026-10-27T20:01:36.935Z", "kind": "kev", "label": "Catalog added", "source": "previdian", "record": "CVE-2026-48356", "field": "evidence.0.details.added_date", "uuid": "beba3015-09e3-4e53-8171-0094c4b96c71", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-27T20:01:39.482Z", "date_only": false, "value": "2026-10-27T20:01:39.482575Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cyfar.ca/post/3myuzp3j6jo2v", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "8135d4b2-afdc-42ae-9841-4786c134b576", "content": "~Cisa~\nCISA added exploited Adobe Commerce/Magento and Google Brotli flaws to its KEV Catalog.\n-\nIOCs: CVE-2026-48356, CVE-2026-111497\n-\n#CVE-2026-111497 #CVE-2026-48356 #ThreatIntel", "url": "https://bsky.app/profile/cyfar.ca/post/3myuzp3j6jo2v"}, {"timestamp": "2026-10-27T20:15:05.169Z", "date_only": false, "value": "2026-10-27T20:15:05.169836Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3myv2h3xsxn2q", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "460e10b2-846a-4683-93bc-bcf1b20f7908", "content": "\ud83d\udea8 NEW on CISA KEV \u2014 exploited in the wild\nAdobe Commerce and Magento: Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulnerability\nCVE-2026-48356 \u00b7 patch by 2026-11-10\n\ud83d\udd17 https://ninjasignal.ninja/intel/cve/CVE-2026-48356\n#KEV #cybersecurity #infosec", "url": "https://bsky.app/profile/ninjaintelgroup.bsky.social/post/3myv2h3xsxn2q"}, {"timestamp": "2026-10-27T20:55:15.813Z", "date_only": false, "value": "2026-10-27T20:55:15.813495Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/vulnidx-jp.bsky.social/post/3myv4owqf3y2b", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "50d10152-8c5b-4a2d-864f-6d8a66120247", "content": "\u3010\u60aa\u7528\u78ba\u8a8d\u3011CVE-2026-48356\n\u30a2\u30c9\u30d3\u306eAdobe Commerce\u7b49\u306e\u8907\u6570\u88fd\u54c1\u306b\u304a\u3051\u308b\u5371\u967a\u306a\u30bf\u30a4\u30d7\u306e\u30d5\u30a1\u30a4\u30eb\u306e\u7121\u5236\u9650\u30a2\u30c3\u30d7\u30ed\u30fc\u30c9\u306b\u95a2\u3059\u308b\u8106\u5f31\u6027\nAdobe Commerce and Magento\nCISA \u8ffd\u52a0 10/27\u30fb\u5bfe\u5fdc\u671f\u9650 11/10\nhttps://jvndb.jvn.jp/ja/contents/2026/JVNDB-2026-023891.html\n#\u8106\u5f31\u6027 #KEV", "url": "https://bsky.app/profile/vulnidx-jp.bsky.social/post/3myv4owqf3y2b"}, {"timestamp": "2026-10-27T21:20:03.888Z", "date_only": false, "value": "2026-10-27T21:20:03.888557Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/aipostdaily.bsky.social/post/3myv63baetv2m", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "556e596a-ef83-4a38-82f1-c4e08a3e2663", "content": "CISA added CVE-2026-48356 to its Known Exploited Vulnerabilities list (2026-10-27).\nAdobe Commerce and Magento Unrestricted Upload of File with Dangerous Type\nEPSS 30 days before listing: 0.010 \u00b7 today: 0.306\n#infosec #KEV", "url": "https://bsky.app/profile/aipostdaily.bsky.social/post/3myv63baetv2m"}, {"timestamp": "2026-10-27T21:33:27Z", "date_only": false, "value": "2026-10-27T21:33:27Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-P3CH-8535-FP8J", "record": "GHSA-P3CH-8535-FP8J", "field": "modified"}, {"timestamp": "2026-10-27T22:43:34.301Z", "date_only": false, "value": "2026-10-27T22:43:34.301679Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/mariogalarza.bsky.social/post/3myvcqmfe6q2z", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "d2b2e78b-e192-4089-9213-30c92c6b7212", "content": "CISA adds 2 actively exploited flaws to KEV: Adobe Commerce/Magento upload flaw CVE-2026-48356 + Google Brotli CVE-2026-111497. Patch now, then hunt for pre-patch compromise. https://www.linkedin.com/feed/update/urn:li:share:7520978454234849280/", "url": "https://bsky.app/profile/mariogalarza.bsky.social/post/3myvcqmfe6q2z"}, {"timestamp": "2026-10-27T23:00:00Z", "date_only": false, "value": "2026-10-27T23:00:00.000+00:00", "kind": "other", "label": "Advisory revision", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2367", "record": "WID-SEC-W-2026-2367", "field": "document.tracking.revision_history.1.date"}, {"timestamp": "2026-10-27T23:00:00Z", "date_only": false, "value": "2026-10-27T23:00:00.000+00:00", "kind": "other", "label": "Updated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2367", "record": "WID-SEC-W-2026-2367", "field": "document.tracking.current_release_date"}, {"timestamp": "2026-10-27T23:52:50.164Z", "date_only": false, "value": "2026-10-27T23:52:50.164681Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securityonline.bsky.social/post/3myvgmhjm5j2m", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "0ea73f4a-3abf-4c90-8c1e-4d85db15207a", "content": "CISA KEV catalog adds actively exploited Magento flaw CVE-2026-48356 and Brotli vulnerability CVE-2026-111497. Patch before November 10.\n\n#CISA #KEV #Magento #AdobeCommerce #Brotli #CVE202648356 #CVE2026111497 #ActiveExploitation", "url": "https://bsky.app/profile/securityonline.bsky.social/post/3myvgmhjm5j2m"}, {"timestamp": "2026-10-28T03:00:07Z", "date_only": false, "value": "2026-10-28T03:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/Gd6rMj__P1CN9FdRGD8rAi8uO0pRqRjcEUaxs0AIor6zVjU", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "1c6908d4-1c51-4e6a-807e-57313717a93b", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-28T03:00:07Z", "date_only": false, "value": "2026-10-28T03:00:07.000000Z", "kind": "sighting", "label": "Seen", "source": "Telegram/Gd6rMj__P1CN9FdRGD8rAi8uO0pRqRjcEUaxs0AIor6zVjU", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "cf7fce75-a2da-4944-8998-669b89699161"}, {"timestamp": "2026-10-28T03:48:59.292Z", "date_only": false, "value": "2026-10-28T03:48:59.292998Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thecircuitry.to/post/3myvtsn3my42i", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "b1de3429-6fe0-4931-a010-4762891bad1a", "content": "CISA added an Adobe Commerce and Magento file-upload flaw, CVE-2026-48356, to its KEV catalog.\nFederal agencies must remediate by Nov 10; Adobe patched it on July 14.\n\nthecircuitry.to/article/cisa-adds-exploited-adobe-commerce-and-magento-flaw-to-kev-mvr4ndkx", "url": "https://bsky.app/profile/thecircuitry.to/post/3myvtsn3my42i"}, {"timestamp": "2026-10-28T03:55:44.631Z", "date_only": false, "value": "2026-10-28T03:55:44.631Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-48356", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-28T03:55:44.631Z", "date_only": false, "value": "2026-10-28T03:55:44.631Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / CISA-ADP", "record": "CVE-2026-48356", "field": "containers.adp.0.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-28T06:30:35.942Z", "date_only": false, "value": "2026-10-28T06:30:35.942211Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/threatspotai.bsky.social/post/3myw4tpxqwu23", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "a4ed858f-55c8-4106-a630-027688e5138d", "content": "\ud83d\udea8 CISA KEV Alert\nCVE-2026-48356: \u26a0\ufe0f CVE-2026-48356: New Actively Exploited Vulnerability Added to CISA KEV\nSeverity: HIGH | CVSS: 0.0 | EPSS: 30.6%\nActively exploited\n\nRead the full alert: https://threatspot.ai/alerts/2026-48356-adobe-commerce-is-affected-by-an", "url": "https://bsky.app/profile/threatspotai.bsky.social/post/3myw4tpxqwu23"}, {"timestamp": "2026-10-28T07:44:58.880Z", "date_only": false, "value": "2026-10-28T07:44:58.880830Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/cybowl.bsky.social/post/3mywaypvi4c23", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "411b1ecc-5c4c-4408-bc24-a30310814367", "content": "\ud83d\udd34 Exploitation confirm\u00e9e (CISA KEV, ajouts du 27/10) \u00b7 1\n\u2022 Adobe Commerce and Magento CVE-2026-48356, CVSS 9.3", "url": "https://bsky.app/profile/cybowl.bsky.social/post/3mywaypvi4c23"}, {"timestamp": "2026-10-28T07:50:35.875Z", "date_only": false, "value": "2026-10-28T07:50:35.875+00:00", "kind": "other", "label": "Document generated", "source": "csaf_certbund \u00b7 WID-SEC-W-2026-2367", "record": "WID-SEC-W-2026-2367", "field": "document.tracking.generator.date"}, {"timestamp": "2026-10-28T08:04:13Z", "date_only": false, "value": "2026-10-28T08:04:13.000000Z", "kind": "sighting", "label": "Seen", "source": "https://threatintel.cc/2026/10/28/adobe-commerce-polyshell-attacks-breach.html", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "1bc5841d-1bfd-497c-a744-032553815c4c", "content": "Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges\n\nCISA on Tuesday added the Adobe Commerce and Magento vulnerability CVE-2026-48356 (CVSS 9.3), known as PolyShell, to its Known Exploited Vulnerabilities catalog, citing active exploitation. Sansec says attackers have used the unrestricted file-upload flaw to breach hundreds of e-commerce stores since at least July 2025, injecting a malicious loader through a Magento CMS block; federal agencies have until November 10, 2026 to apply the fixes.", "url": "https://threatintel.cc/2026/10/28/adobe-commerce-polyshell-attacks-breach.html"}, {"timestamp": "2026-10-28T08:14:55.606Z", "date_only": false, "value": "2026-10-28T08:14:55.606319Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mywcoam63e2k", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "6999b0d7-74a0-4d3a-81c4-a9ebbbc3f938", "content": "Adobe Commerce/Magento CVE-2026-48356 (CVSS 9.3, file upload to code execution) is now on CISA KEV as exploited. Fix shipped in July under APSB26-73; Commerce Events needs 1.21.0. Sweep pub/media for .php files. https://cti.securitycyber.uk", "url": "https://bsky.app/profile/securitycyebruk.bsky.social/post/3mywcoam63e2k"}, {"timestamp": "2026-10-28T09:04:30.314Z", "date_only": false, "value": "2026-10-28T09:04:30.314330Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/edwardk/statuses/117517731090748485", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "a8acf24f-34c8-42ac-9398-3c32e9050296", "content": "Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges\nCISA on Tuesday added the Adobe Commerce and Magento vulnerability CVE-2026-48356 (CVSS 9.3), known as PolyShell, to its Known Exploited Vulnerabilities catalog, citing active exploitation. Sansec says attackers have used the unrestricted file-upload flaw to breach hundreds of e-commerce stores since at least July 2025, injecting a malicious loader through a Magento CMS block; federal agencies have until November 10, 2026 to apply the fixes. https://thehackernews.com/2026/10/adobe-commerce-polyshell-attacks-breach.html", "url": "https://infosec.exchange/users/edwardk/statuses/117517731090748485"}, {"timestamp": "2026-10-28T09:04:31.024Z", "date_only": false, "value": "2026-10-28T09:04:31.024043Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mywfgwyd3h25", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "9b4797e3-9ccc-4a21-8a85-8729eebb4e9e", "content": "Adobe Commerce PolyShell Attacks Breach Hundreds of Stores as Brotli Exploit Traffic Emerges\n\nCISA on Tuesday added the Adobe Commerce and Magento vulnerability CVE-2026-48356 (CVSS 9.3), known as PolyShell, to its Kno... https://threatintel.cc/2026/10/28/adobe-commerce-polyshell-attacks-breach.html", "url": "https://bsky.app/profile/e-kiledjian.bsky.social/post/3mywfgwyd3h25"}, {"timestamp": "2026-10-28T13:34:50.330Z", "date_only": false, "value": "2026-10-28T13:34:50.330", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-48356", "record": "FKIE_CVE-2026-48356", "field": "lastModified"}, {"timestamp": "2026-10-28T13:45:59.125Z", "date_only": false, "value": "2026-10-28T13:45:59.125807Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/0daynews.bsky.social/post/3mywv6a6vbq2d", "record": "cve-2026-48356", "field": "creation_timestamp", "uuid": "bb80f5c0-e7f1-4895-8b1c-e1e5fdc5b0d6", "content": "adobe commerce and brotli impacted by cisa adding CVE-2026-48356, CVE-2026-111497 to KEV catalog due to polyshell attacks #infosec https://0daynews.com/articles/2026-10-28-adobe-commerce-cve-2026-48356-polyshell-brotli-kev/", "url": "https://bsky.app/profile/0daynews.bsky.social/post/3mywv6a6vbq2d"}, {"timestamp": "2026-10-28T14:48:11.841Z", "date_only": false, "value": "2026-10-28T14:48:11.841936Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mywynihszu2d", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "c23760e3-664d-4ac5-bb87-357c20afe311", "content": "CISA added CVE-2026-48356 in Adobe Commerce and Magento and CVE-2026-111497 in Google Brotli to its KEV Catalog based on evidence of active exploitation, urging organizations to prioritize remediation.", "url": "https://bsky.app/profile/hendryadrian.bsky.social/post/3mywynihszu2d"}, {"timestamp": "2026-10-28T14:48:34.874Z", "date_only": false, "value": "2026-10-28T14:48:34.874780Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/phpscientist.bsky.social/post/3mywyo5bnw22c", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "92c7bbfd-0a54-46a8-83e2-5b132e13ab07", "content": "PolyShell (CVE-2026-48356): The Actively Exploited Magento Flaw Every Store Owner Must Act On phpscientist.com/blog/magento...", "url": "https://bsky.app/profile/phpscientist.bsky.social/post/3mywyo5bnw22c"}, {"timestamp": "2026-10-28T14:53:55.136Z", "date_only": false, "value": "2026-10-28T14:53:55.136525Z", "kind": "sighting", "label": "Seen", "source": "https://mastodon.social/ap/users/115426718704364579/statuses/117519104587009122", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "595ded37-d2b2-472d-8c9b-65f0ffe1a7bb", "content": "\ud83d\udcf0 CISA Adds Exploited Google Brotli and Adobe Commerce Flaws to KEV\n\ud83d\udce2 CISA adds two actively exploited vulns to its KEV catalog: Node2Shell (CVE-2026-111497) in Google Brotli & a file upload flaw (CVE-2026-48356) in Adobe Commerce. Federal agencies must patch by Nov 10. #PatchNow #CISA #KEV\n\ud83d\udd17 https://cyber.netsecops.io/articles/cisa-adds-exploited-google-brotli-and-adobe-commerce-flaws-to-kev-catalog/?utm_source=mastodon&utm_medium=social&utm_campaign=daily", "url": "https://mastodon.social/ap/users/115426718704364579/statuses/117519104587009122"}, {"timestamp": "2026-10-28T14:54:17.097Z", "date_only": false, "value": "2026-10-28T14:54:17.097006Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/netsecio.bsky.social/post/3mywyyehegk2a", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "b7c4baf4-4b89-49fb-bb65-3b6cd2024b86", "content": "\ud83d\udce2 CISA adds two actively exploited vulns to its KEV catalog: Node2Shell (CVE-2026-111497) in Google Brotli & a file upload flaw (CVE-2026-48356) in Adobe Commerce. Federal agencies must patch by Nov 10. #PatchNow #CISA #KEV\n\n\ud83c\udf10 cyber[.]netsecops[.]io", "url": "https://bsky.app/profile/netsecio.bsky.social/post/3mywyyehegk2a"}, {"timestamp": "2026-10-28T18:15:28.698Z", "date_only": false, "value": "2026-10-28T18:15:28.698345Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3myxea4nfn22u", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "161a0123-e6d1-4014-94d2-0538940dfb57", "content": "\ud83d\udee1\ufe0f Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-111497 \u00b7 46 people \ud83d\udd25\n2. CVE-2026-109618 \u00b7 33 people \ud83d\udd25\n3. CVE-2026-97631 \u00b7 32 people\n4. CVE-2026-109619 \u00b7 26 people \ud83d\udd25\n5. CVE-2026-48356 \u00b7 15 people \ud83d\udd25\n\n\ud83d\udd25 = on CISA's Known Exploited list \u00b7 details in the thread \ud83e\uddf5", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3myxea4nfn22u"}, {"timestamp": "2026-10-28T18:15:31.099Z", "date_only": false, "value": "2026-10-28T18:15:31.099714Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/alt.pds.lefht.cc/post/3myxea5e2ak2u", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "a3e50d14-755e-4cfe-9c7d-efba6915b64b", "content": "5. CVE-2026-48356 \u00b7 15 people \ud83d\udd25\n\ud83d\udfe5 Critical 9.3 \u00b7 Adobe Commerce\n\nAdobe Commerce | Unrestricted Upload of File with Dangerous Type (CWE-434)", "url": "https://bsky.app/profile/alt.pds.lefht.cc/post/3myxea5e2ak2u"}, {"timestamp": "2026-10-28T21:00:01Z", "date_only": false, "value": "2026-10-28T21:00:01+00:00", "kind": "kev", "label": "Recorded", "source": "previdian", "record": "CVE-2026-48356", "field": "timestamps.recorded_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "beba3015-09e3-4e53-8171-0094c4b96c71", "status": {"status_reason": "confirmed", "exploited": true}}, {"timestamp": "2026-10-28T21:00:26.983Z", "date_only": false, "value": "2026-10-28T21:00:26.983001Z", "kind": "sighting", "label": "Exploited", "source": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/beba3015-09e3-4e53-8171-0094c4b96c71", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "a45107cd-9841-43ae-b8a3-6a832dbaeb6d", "url": "https://vulnerability.circl.lu/known-exploited-vulnerabilities-catalog/beba3015-09e3-4e53-8171-0094c4b96c71", "metric_role": "exploitation", "metric_basis": "sighting_report"}, {"timestamp": "2026-10-29T01:28:03.768Z", "date_only": false, "value": "2026-10-29T01:28:03.768372Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/trustlist.bsky.social/post/3myy4fmldun2z", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "e8da9665-5457-4574-9272-145989a604ac", "content": "Security advisories 24/29\nCISA lists Adobe Commerce file-upload flaw as exploited, fix due 10 November\n\nCVE-2026-48356, rated 9.3, was published in NVD in July.\n\n#infosec #cybersecurity\ntrustlist.uk/security-advisorie\u2026", "url": "https://bsky.app/profile/trustlist.bsky.social/post/3myy4fmldun2z"}, {"timestamp": "2026-11-10T00:00:00Z", "date_only": true, "value": "2026-11-10", "kind": "kev", "label": "Due date", "source": "cisa-kev", "record": "CVE-2026-48356", "field": "evidence.0.details.due_date", "uuid": "2ddf3cd3-17ec-4eed-8360-1b806ca6c707", "status": {"status_reason": "confirmed", "exploited": true}}], "metrics": {"as_of": "2026-11-01T02:42:53.525Z", "anchors": {"origin": {"timestamp": "2026-07-14T17:00:00Z", "date_only": false, "value": "2026-07-14T17:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / adobe", "record": "CVE-2026-48356", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "discovery": null, "report": null, "acknowledgement": null, "disclosure": {"timestamp": "2026-07-14T17:00:00Z", "date_only": false, "value": "2026-07-14T17:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / adobe", "record": "CVE-2026-48356", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "exploit_publication": {"timestamp": "2026-09-26T15:00:07Z", "date_only": false, "value": "2026-09-26T15:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/ZwzTOKK99bJ7BFqHmsNQhcBtNpWeVQ50id2s1j08rwHDfjQ", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "0a4e2c62-7bb7-42e6-aa5c-6e443796f946", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "exploitation": {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-48356", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "2ddf3cd3-17ec-4eed-8360-1b806ca6c707", "status": {"status_reason": "confirmed", "exploited": true}}, "patch": null}, "vendor_response_time": {"available": false, "missing": ["start", "end"]}, "time_to_exploit": {"available": true, "seconds": 9010800.0, "hours": 2503.0, "days": 104.29166666666667, "min_seconds": 9010800.0, "max_seconds": 9097200.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-14T17:00:00Z", "date_only": false, "value": "2026-07-14T17:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / adobe", "record": "CVE-2026-48356", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-48356", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "2ddf3cd3-17ec-4eed-8360-1b806ca6c707", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit": {"available": true, "seconds": 9010800.0, "hours": 2503.0, "days": 104.29166666666667, "min_seconds": 9010800.0, "max_seconds": 9097200.0, "approximate": true, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-14T17:00:00Z", "date_only": false, "value": "2026-07-14T17:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / adobe", "record": "CVE-2026-48356", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-48356", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "2ddf3cd3-17ec-4eed-8360-1b806ca6c707", "status": {"status_reason": "confirmed", "exploited": true}}}, "disclosure_to_exploit_publication": {"available": true, "seconds": 6386407.0, "hours": 1774.0019444444445, "days": 73.91674768518519, "min_seconds": 6386407.0, "max_seconds": 6386407.0, "approximate": false, "ongoing": false, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-14T17:00:00Z", "date_only": false, "value": "2026-07-14T17:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / adobe", "record": "CVE-2026-48356", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-09-26T15:00:07Z", "date_only": false, "value": "2026-09-26T15:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/ZwzTOKK99bJ7BFqHmsNQhcBtNpWeVQ50id2s1j08rwHDfjQ", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "0a4e2c62-7bb7-42e6-aa5c-6e443796f946", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}}, "time_to_patch": {"available": false, "missing": ["start", "end"]}, "total_time_to_patch": {"available": false, "missing": ["start", "end"]}, "disclosure_to_patch": {"available": false, "missing": ["end"]}, "time_unpatched": {"available": true, "seconds": 9452573.525028, "hours": 2625.714868063333, "days": 109.40478616930555, "min_seconds": 9452573.525028, "max_seconds": 9452573.525028, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-07-14T17:00:00Z", "date_only": false, "value": "2026-07-14T17:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / adobe", "record": "CVE-2026-48356", "field": "containers.cna.datePublic", "metric_role": "disclosure", "metric_basis": "recorded_event"}, "end": {"timestamp": "2026-11-01T02:42:53.525Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploitation_to_patch": {"available": true, "seconds": 441773.525028, "hours": 122.71486806333334, "days": 5.113119502638889, "min_seconds": 355373.525028, "max_seconds": 441773.525028, "approximate": true, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-10-27T00:00:00Z", "date_only": false, "value": "2026-10-27T00:00:00+00:00", "kind": "kev", "label": "Asserted", "source": "cisa-kev", "record": "CVE-2026-48356", "field": "timestamps.asserted_at", "metric_role": "exploitation_report", "metric_basis": "kev_report", "uuid": "2ddf3cd3-17ec-4eed-8360-1b806ca6c707", "status": {"status_reason": "confirmed", "exploited": true}}, "end": {"timestamp": "2026-11-01T02:42:53.525Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}, "exploit_publication_to_patch": {"available": true, "seconds": 3066166.525028, "hours": 851.7129236188889, "days": 35.48803848412037, "min_seconds": 3066166.525028, "max_seconds": 3066166.525028, "approximate": false, "ongoing": true, "order_known": true, "batch_listing": false, "end_before_start": false, "start": {"timestamp": "2026-09-26T15:00:07Z", "date_only": false, "value": "2026-09-26T15:00:07.000000Z", "kind": "sighting", "label": "Published proof of concept", "source": "Telegram/ZwzTOKK99bJ7BFqHmsNQhcBtNpWeVQ50id2s1j08rwHDfjQ", "record": "CVE-2026-48356", "field": "creation_timestamp", "uuid": "0a4e2c62-7bb7-42e6-aa5c-6e443796f946", "metric_role": "exploit_publication", "metric_basis": "sighting_report"}, "end": {"timestamp": "2026-11-01T02:42:53.525Z", "date_only": false, "label": "As of", "source": "Calculation clock"}}}}